Bitcoin Core just disclosed a high-severity vulnerability, but it was actually fixed a year ago.
On November 10, Bitcoin Core publicly disclosed three security vulnerabilities that had already been fixed. The most serious was CVE-2025-62861, rated high severity: miner nodes running versions 28.0 to 28.2 or 29.0 to 29.1 could fail to produce valid block templates during a chain reorganization, and had to be restarted to recover. The other two were rated medium severity: one could let a malicious node slow down block processing, while the other involved whitelist permissions for Tor proxies.
The timeline is key: the vulnerability was reported in September 2025, and a fix was released that October in versions 30.0, 29.2, and 28.3. Yet the project waited until two weeks after support for the 29.x series ended—that is, 396 days later—to disclose the details. There have been no reports of funds being at risk, and no in-the-wild exploitation has been detected.
In my view, this barely affects ordinary people who hold Bitcoin. The ones who really need to upgrade are nodes and mining pools still running old versions. What’s worth noting instead is the process: patch first, then disclose the details once older versions are retired, leaving attackers no window of opportunity. Bitcoin has avoided major trouble for over a decade thanks to this kind of painstaking approach. The price hasn’t reacted either: $BTC is still hovering around 73,600, the Fear & Greed Index is at 28, and right now the market is more worried about rate hikes than code.
On November 10, Bitcoin Core publicly disclosed three security vulnerabilities that had already been fixed. The most serious was CVE-2025-62861, rated high severity: miner nodes running versions 28.0 to 28.2 or 29.0 to 29.1 could fail to produce valid block templates during a chain reorganization, and had to be restarted to recover. The other two were rated medium severity: one could let a malicious node slow down block processing, while the other involved whitelist permissions for Tor proxies.
The timeline is key: the vulnerability was reported in September 2025, and a fix was released that October in versions 30.0, 29.2, and 28.3. Yet the project waited until two weeks after support for the 29.x series ended—that is, 396 days later—to disclose the details. There have been no reports of funds being at risk, and no in-the-wild exploitation has been detected.
In my view, this barely affects ordinary people who hold Bitcoin. The ones who really need to upgrade are nodes and mining pools still running old versions. What’s worth noting instead is the process: patch first, then disclose the details once older versions are retired, leaving attackers no window of opportunity. Bitcoin has avoided major trouble for over a decade thanks to this kind of painstaking approach. The price hasn’t reacted either: $BTC is still hovering around 73,600, the Fear & Greed Index is at 28, and right now the market is more worried about rate hikes than code.
